Verifying JSON and TOML changes

• Security scanning Injection, unsafe APIs and tainted data reaching a sink.
  codeql 50% · 4 of 8 repos

  runs via GitHub Action github/codeql-action/analyze

  exit codes, docs, alternatives, where it runs

  • Runs inci
  • Alternativessemgrep 12%
  • Seen inhome-assistant/core, appwrite/appwrite, the-pr-agent/pr-agent, Azure/Azure-Sentinel
  • Docshttps://github.com/github/codeql
• Secret scanning Credentials and tokens committed to the repository.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Dependency audit Known-vulnerable or disallowed dependencies and licenses.
  dependency-review 25% · 2 of 8 repos

  runs via GitHub Action actions/dependency-review-action

  exit codes, docs, alternatives, where it runs

  • Runs inci
  • Seen inhome-assistant/core, zed-industries/zed
  • Docshttps://github.com/actions/dependency-review-action

• Parameterize security commandsWhen writing security-related CLI commands or remediation steps, always use standardized parameter placeholders (e.g., ``, `

  prowler-cloud/prowler Security Json security 2025-03-11

  copy raw open
• Align RBAC and IdentityWhen defining permissions or identities in IaC (ARM/CloudFormation/templates), ensure the security configuration matches the actual runti...

  Azure/Azure-Sentinel Security Json cloud-infra 2026-06-26

  copy raw open
• Strict auth schema validationSecurity-related Helm/config schemas should fail fast on invalid or unintended authentication settings. Apply: - Close security-sensitive...

  maximhq/bifrost Security Json llm-infra 2026-07-21

  copy raw open
• Azure encryption property namesWhen configuring encryption settings for Azure resources in ARM templates, always use the correct property names as documented in the Azu...

  bridgecrewio/checkov Security Json security 2024-07-15

  copy raw open
• Use correct encryption propertiesWhen configuring security features in Azure ARM templates, always use the correct property names as specified in the Azure documentation....

  bridgecrewio/checkov Security Json security 2024-07-15

  copy raw open

18 more in Security — the playbook lists the top 12.

• Type checking Wrong types, unhandled null or None, call signatures broken across modules.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Use Stable API VersionsWhen defining or calling APIs (including Azure Sentinel/Microsoft Security connector artifacts), always use a stable, supported `apiVersi...

  Azure/Azure-Sentinel API Json cloud-infra 2026-07-31

  copy raw open
• Null Safety PatternsWhen fields or parameters are optional (may be missing, null, or empty-string), code must be defensive so queries/playbooks/parsers don’t...

  Azure/Azure-Sentinel Null Handling Json cloud-infra 2026-07-21

  copy raw open
• Explicit API ContractsWhen authoring templates or clients that call/describe APIs (Graph, resource providers, etc.), treat the “API contract” as a first-class ...

  Azure/azure-quickstart-templates API Json cloud-infra 2026-06-01

  copy raw open
• Null and Omission SafetyWhen a config field is optional/nullable (or has multiple shapes), never rely on “default” or presence quirks. Make absence vs presence e...

  maximhq/bifrost Null Handling Json llm-infra 2026-07-27

  copy raw open
• API documentation consistencyEnsure all API-related descriptions, field names, and documentation accurately reflect the terminology and specifications used by externa...

  home-assistant/core API Json app-frameworks 2025-07-26

  copy raw open

12 more in API, Error Handling, Null Handling — the playbook lists the top 12.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 38% · 3 of 8 repos

  analyze (language: 1)copy

  exit codes, docs, alternatives, where it runs

  • Commands seenanalyze (include: 1)
analyze (language: 1)
analyze (language: 5)
  • Runs inci
  • Seen inappwrite/appwrite, the-pr-agent/pr-agent, Azure/Azure-Sentinel
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

• Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Fuzzing Crashes, panics and hangs on malformed input, especially in parsers and decoders.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Mutation testing Tests that keep passing whatever the code does.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Proofs and specifications Design-level bugs in protocols and algorithms, checked against a specification.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Constrain UI Rule MatchingWhen building text-based state detectors (e.g., parsing a live UI/pane), treat each rule like an algorithmic classifier: make matches pre...

  ogulcancelik/herdr Algorithms Toml app-frameworks 2026-08-09

  copy raw open
• Regex Guardrails for FiltersWhen implementing CLI output filters (regex/pattern matchers), make the match logic algorithmically safe: add explicit bypass guards for ...

  diegosouzapw/OmniRoute Algorithms Json llm-infra 2026-05-28

  copy raw open

• Concurrency model checking Races and orderings that fail only under specific interleavings.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Undefined-behaviour detection Memory-safety and aliasing violations in unsafe code.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Fuzzing Crashes, panics and hangs on malformed input, especially in parsers and decoders.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Single Source Network DefinitionsWhen authoring ARM/Bicep templates, model networking topology as a single source of truth and avoid redundant resources/dependencies. App...

  Azure/azure-quickstart-templates Networking Json cloud-infra 2025-06-05

  copy raw open

• End-to-end browser tests User flows broken across components, routing and the network.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Linting Bug-prone patterns, unused code and conventions the formatter does not cover.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Use Angular v19+ StrictnessWhen targeting Angular v19+ (or modernizing to it), align your package peer/dependency baselines and update tsconfig to the corresponding...

  tanstack/query Angular Json app-frameworks 2026-02-09

  copy raw open

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 38% · 3 of 8 repos

  analyze (language: 1)copy

  exit codes, docs, alternatives, where it runs

  • Commands seenanalyze (include: 1)
analyze (language: 1)
analyze (language: 5)
  • Runs inci
  • Seen inappwrite/appwrite, the-pr-agent/pr-agent, Azure/Azure-Sentinel
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

• Schema-First DCR KQLFor data connector definitions (DCR + KQL transforms), treat the DCR `streamDeclarations.columns` as the schema contract and ensure KQL t...

  Azure/Azure-Sentinel Database Json cloud-infra 2026-07-29

  copy raw open
• Backcompatible Migration ContractWhen making schema/connector changes that can affect existing customer deployments (e.g., new CCF/CL tables, changed table generation beh...

  Azure/Azure-Sentinel Migrations Json cloud-infra 2026-06-26

  copy raw open
• Version migration dependencies carefullyWhen updating dependencies for migration-related components or making schema changes, verify compatibility and ensure backward compatibil...

  appwrite/appwrite Migrations Json app-frameworks 2025-07-21

  copy raw open
• Cache keys drive rebuildsWhen using uv to build Python extensions via PEP 517 (e.g., maturin), ensure cache invalidation is keyed to the actual build inputs. Conf...

  karpathy/nanochat Caching Toml ml-systems 2025-10-30

  copy raw open
• Enable database resilienceAlways configure appropriate resilience features for database services to ensure data durability and high availability. This includes: 1....

  prowler-cloud/prowler Database Json security 2025-03-11

  copy raw open

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• AI model data validationAll AI model configuration parameters must be verified against official provider documentation before merging. This includes token limits...

  BerriAI/litellm AI Json llm-infra 2025-08-10

  copy raw open
• Bound LLM BudgetsWhen configuring generative AI for code-review workflows, keep prompts and model behaviors tightly bounded to control latency/cost while ...

  the-pr-agent/pr-agent AI Toml ai-agents 2025-06-18

  copy raw open
• model description accuracyEnsure AI model descriptions are specific, capability-focused, and avoid marketing language or temporal references like "latest". Descrip...

  menloresearch/jan AI Json llm-infra 2024-04-22

  copy raw open
• AI dependency managementWhen integrating AI models and language processing libraries, follow these dependency management best practices: 1. Use specific model in...

  langchain-ai/langchainjs AI Json ai-agents 2024-11-21

  copy raw open
• Validate model limitsWhen integrating LLM providers, don’t assume the provider’s model spec equals what the specific API endpoint will actually accept. Enforc...

  aaif-goose/goose AI Json ai-agents 2026-07-14

  copy raw open

4 more in AI, Pytorch — the playbook lists the top 9.

• CI workflow linting Broken GitHub Actions syntax, script injection, over-broad token permissions.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• File hygiene Invalid JSON, YAML or TOML, merge markers, trailing whitespace, oversized files.
  pre-commit-hooks 25% · 2 of 8 repos autofix

  runs via pre-commit hook check-json

  exit codes, docs, alternatives, where it runs

  • Commands seenpre-commit hook check-json
pre-commit hook check-added-large-files
pre-commit hook check-ast
  • Runs inpre-commit, ci
  • Seen inhome-assistant/core, the-pr-agent/pr-agent
  • Docshttps://github.com/pre-commit/pre-commit-hooks

• Dependency version rangesWhen editing dependency versions in package.json, follow the team's agreed semver range convention rather than mixing styles ad hoc. Unle...

  Expressjs/Express Configurations Json app-frameworks 2025-03-10

  copy raw open
• Consistent dependency configMaintain configuration consistency and compatibility by using a single, intentional strategy for dependency declarations, peer ranges, an...

  tanstack/query Configurations Json app-frameworks 2026-04-26

  copy raw open
• Validate Block JSONEnsure every `curriculum/structure/blocks/*.json` file matches the CI-validated schema and constraints. - Remove deprecated/unused fields...

  freeCodeCamp/freeCodeCamp CI/CD Json docs 2026-04-07

  copy raw open
• Environment-Driven ParametersWhen a template needs configuration that varies by environment/cloud/region or depends on real resource identifiers, do not hardcode endp...

  Azure/azure-quickstart-templates Configurations Json cloud-infra 2026-05-13

  copy raw open
• Config schema conventionsProvide a clear, stable, and discoverable configuration schema. Apply the following rules to all TOML/environment configs: 1) Use self-do...

  p-e-w/heretic Configurations Toml ml-systems 2026-01-26

  copy raw open

130 more in CI/CD, Configurations — the playbook lists the top 12.

• Dependency audit Known-vulnerable or disallowed dependencies and licenses.
  dependency-review 25% · 2 of 8 repos

  runs via GitHub Action actions/dependency-review-action

  exit codes, docs, alternatives, where it runs

  • Runs inci
  • Seen inhome-assistant/core, zed-industries/zed
  • Docshttps://github.com/actions/dependency-review-action
• Lockfile consistency A lockfile that no longer matches its manifest.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 38% · 3 of 8 repos

  analyze (language: 1)copy

  exit codes, docs, alternatives, where it runs

  • Commands seenanalyze (include: 1)
analyze (language: 1)
analyze (language: 5)
  • Runs inci
  • Seen inappwrite/appwrite, the-pr-agent/pr-agent, Azure/Azure-Sentinel
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

• Mutation testing Tests that keep passing whatever the code does.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 38% · 3 of 8 repos

  analyze (language: 1)copy

  exit codes, docs, alternatives, where it runs

  • Commands seenanalyze (include: 1)
analyze (language: 1)
analyze (language: 5)
  • Runs inci
  • Seen inappwrite/appwrite, the-pr-agent/pr-agent, Azure/Azure-Sentinel
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

• Type-Safe, Scripted TestsEnsure your testing approach covers both runtime behavior and public API types, and that the test scripts you expose are correct, documen...

  tanstack/query Testing Json app-frameworks 2026-04-23

  copy raw open
• manage testing dependenciesEnsure testing dependencies are properly organized, avoid redundancy, and proactively manage unmaintained packages. Place testing-specifi...

  python-poetry/poetry Testing Toml devtools 2025-01-12

  copy raw open
• document test configurationsWhen modifying test configurations or tooling settings, provide clear explanations of what the changes actually do and why specific optio...

  jj-vcs/jj Testing Toml devtools 2025-09-24

  copy raw open
• Avoid skipping e2e testsDo not use the `skip_e2e` flag to bypass end-to-end tests that fail. Instead, fix the test implementation by providing appropriate test d...

  vitessio/vitess Testing Json data-systems 2025-03-20

  copy raw open
• Precise testing dependency versioningWhen specifying testing library dependencies, always use explicit minimum patch versions rather than development branches or broad versio...

  laravel/framework Testing Json app-frameworks 2025-02-07

  copy raw open

8 more in Testing — the playbook lists the top 12.

• Docs build Broken cross-references, links and markup in documentation.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Spelling Typos in identifiers, comments and docs.
  codespell 12% · 1 of 8 repos

  runs via pre-commit hook codespell

  exit codes, docs, alternatives, where it runs

  • Runs inpre-commit
  • Seen inhome-assistant/core
  • Docshttps://github.com/codespell-project/codespell

• Complete locale translationsEnsure that all text strings in locale-specific files are properly translated into their respective languages. Leaving untranslated Engli...

  RooCodeInc/Roo-Code Documentation Json ai-agents 2025-07-22

  copy raw open
• Document Packaging ConventionsWhen updating Sentinel solution documentation artifacts (workbooks metadata, UI definitions, and connector table schemas), treat them as ...

  Azure/Azure-Sentinel Documentation Json cloud-infra 2026-07-21

  copy raw open
• In-code Documentation ConsistencyEnsure any developer-facing documentation embedded in the codebase (template metadata, links, and sample deployment instructions) is comp...

  Azure/azure-quickstart-templates Documentation Json cloud-infra 2023-02-22

  copy raw open
• Consistent documentation languageMaintain consistency in wording, formatting, and specificity across all documentation strings to improve readability and translation qual...

  home-assistant/core Documentation Json app-frameworks 2025-07-26

  copy raw open
• Complete accurate documentationDocumentation should provide complete, accurate guidance that doesn't mislead developers about correct usage patterns. Avoid documentatio...

  remix-run/react-router Documentation Json app-frameworks 2025-07-22

  copy raw open

3 more in Documentation — the playbook lists the top 8.